Wireless communication systems provide for radio communication links to be arranged within the system between a plurality of user terminals. Such user terminals may be mobile and may therefore be known as ‘mobile stations.’ At least one other terminal, e.g. used in conjunction with mobile stations, may be a fixed terminal, e.g. a control terminal, base station, or access point. Such a system typically includes a system infrastructure which generally includes a network of various fixed installations such as base stations, which are in direct radio communication with the mobile stations. Each of the base stations operating in the system may have one or more transceivers which may, for example, serve mobile stations in a given local region or area, known as a ‘cell’ or ‘site’, by radio frequency (RF) communication. The mobile stations which are in direct communication with a particular base station are said to be served by the base station, and all radio communications to and from each mobile station within the system are made via respective serving base stations. Sites of neighbouring base stations in a wireless communication system may be offset from one another or may be overlapping.
Wireless communication systems may operate according to an industry standard protocol such as, for example, the Project 25 (P25) standard defined by the Association of Public Safety Communications Officials International (APCO), or other radio protocols. Further details regarding the P25 standards can be obtained from the Telecommunications Industry Association, 2500 Wilson Boulevard, Suite 300 Arlington, Va. Communications in accordance with P25 or other standards may take place over physical channels in accordance with one or more of a TDMA (time division multiple access) protocol, a FDMA (frequency divisional multiple access), or CDMA (code division multiple access) protocol. Mobile stations in wireless communication systems such as P25 systems send user communicated speech and data, herein referred to collectively as ‘traffic information’, in accordance with the designated protocol.
Many wireless communication systems, including many P25 systems, employ a procedure to encrypt sensitive communicated traffic information, especially where the information is sent via insecure channels, e.g. by wireless communication over-the-air. For example, in some wireless communication systems, communications can be end-to-end encrypted. This means that encryption of traffic information is applied by an original transmitting terminal of the sender (source) of the traffic information and removed by a final receiving terminal of the recipient (destination) of the traffic information. Intermediate terminals that facilitate the delivery of the encrypted traffic information are unable to decrypt the encrypted traffic information (or at least, are unable to do so in a reasonable amount of time).
In addition to end-to-end encryption, link layer encryption (LLE) may additionally be used between individual links in a path from a source transmitter to a destination receiver to further prevent the interception or monitoring of traffic information transmitted over-the-air, such as between mobile stations and base stations. For example, even when end-to-end encryption is used to encrypt digitized voice data, some control and/or signalling data is necessarily sent unencrypted over-the-air to allow the receiving device (such as the base station or mobile station) to identify a sender or receiver, talkgroup ID, or to obtain information such as an algorithm ID or key ID sufficient to begin decrypting the end-to-end encrypted voice data. LLE may be used, for example, to encrypt over-the-air communication links between mobile stations and base stations, and advantageously prevent an eavesdropper from intercepting information transmitted over-the-air, such as group ID's, transmitter ID's, target ID's, algorithm IDs, key IDs, or other control information.
FIG. 1 illustrates an example of how encryption may be achieved between a transmitter 101 and receiver 103 over an intervening channel 105 (e.g., air-interface) by producing a random or pseudo-random data sequence of binary digits (e.g., an encryption initialization vector 111) and using a combining procedure (e.g., an encryption algorithm 115) to combine the encryption initialization vector 111 with a secret key variable 113 supplied by the user. The combination generates another data sequence, known as a keystream, incorporating the secret key variable 113. The keystream, or a portion of it, is then used internally by the encryption algorithm 115 to encrypt the user traffic information 117 to be transmitted in encrypted form as encrypted traffic information 133. This is done in an encryption processor by using a combination procedure, such as an XOR (exclusive OR) combination procedure, to combine the unencrypted traffic information 117 with the keystream, e.g. on a frame-by-frame basis. The encryption initialization vector 111 may be loaded into a linear feedback shift register (LFSR), for example, and may be clocked to provide a time-varying keystream.
The secret key variable 113 used at the transmitter 101 is known at the receiver 103 and is thus never transmitted openly (e.g., unencrypted). The receiver 103 is sent the encryption initialization vector 111, an identifier identifying the encryption algorithm 115 used at the transmitter 101 (assuming it is not hardcoded in both transmitter 101 and receiver 103), and an identifier identifying the key variable 113 used at the transmitter 101 (assuming it is not hardcoded in both transmitter 101 and receiver 103) via a sync block 131 transmitted over the channel 105 and included in one or more of a header information structure or embedded in a data payload frame. The transmitter 101 also transmits the encrypted traffic information 133 over the channel 105 for reception by the receiver 103. The receiver 103 is thereby able to re-construct the keystream applied at the transmitter 101. The receiver 103 combines the reconstructed keystream with the encrypted traffic 133 it receives in a manner such that the keystream included in the encrypted traffic 133 is cancelled allowing the original user traffic 163 to be extracted in unencrypted form. For example, the receiver 103 may use a same clocked LFSR as used by the transmitter 101 to provide a same time-varying keystream using the retrieved encryption initialization vector 111 transmitted in the sync block 131.
The encryption/decryption process therefore typically includes (i) operation of an encryption algorithm in a processor of a transmitting terminal to encrypt the information to be transmitted, and (ii) operation of a related decryption algorithm in a receiving terminal to decrypt the received encrypted traffic information.
Because an LLE encryption key can, given enough time and computing power, be brute-force decoded by an intercepting device, many LLE encryption/decryption processes incorporate a rekeying procedure in which the shared key used by the transmitter and receiver to encrypt and decrypt communications will be periodically changed. A period during which a particular shared key is used to encrypt and decrypt communications (between one or more transmitting devices and one or more receiving devices) may be referred to as an LLE crypto period. For example, at a predetermined period in time, an authentication controller in a radio network may decide to switch from a current shared key to a new shared key. When this occurs, however, a number of individual rekey requests generated by mobile stations seeking the new shared key (in order to LLE decrypt communications encrypted with the shared key) can overwhelm the authentication controller and/or the over-the-air bandwidth available to transmit what may be a significant amount of data (new shared keys to each requesting mobile station).
Established air-interface protocols such as P25 may not provide sufficient available over-the-air bandwidth to satisfy each of the individual rekey requests without incurring substantial delays and/or performance degradation. Furthermore, such established air-interface protocols may not provide a means for the authentication controller to determine which, and how many out of a total number of currently operating (or previously operating), mobile stations have both the current LLE key and the future LLE key. Accordingly, what is needed is an improved method, device, and system for rekeying that can aid in reducing over-the-air bandwidth requirements, preventing substantial delays and performance degradation, and allows for more intelligent distribution of new shared keys.